Add chart-driven OIDC SSO, existingSecret support, and optional console backend TLS

Summary

• The init Job configures SAML SSO through settings/saml, but there is no equivalent wiring for OIDC.
• Teams federating Prisma Cloud Compute with Keycloak, Okta, or another OIDC IdP configure the Console by hand after install.
• The manual setup is not in Git and drifts across staging, production, and DR rebuilds.

Impact

• OIDC is the only install-time identity setting the chart does not manage declaratively.
• The OIDC client secret has nowhere to live declaratively; it is pasted into the UI or committed in plain text.
• console.groups entries with oidcGroup fail until someone enables the provider manually, producing confusing login errors.
• Console builds the OIDC redirect_uri from its own TLS state and ignores X-Forwarded-Proto, so an Istio gateway forwarding plain HTTP produces an http:// redirect that IdPs reject.

Proposed resolution

• Mirror the SAML wiring: an oidc values block, secret-oidc.yaml, twistlock-oidc.sh, an init dispatch line, and an init Job volume, all off by default.
• Add sso.existingSecret and oidc.existingSecret so the SAML cert and OIDC client secret can come from a pre-created Secret.
• Add console.groups[].authTypes so one group record can match SAML and OIDC during a mixed rollout.
• Add an opt-in console.backendTLS that routes the gateway-to-Console leg over HTTPS on 8083 so Console emits an https:// redirect URI.